7

CVE-2015-1862

Exploit
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Abrt Project ≫ Abrt Version <= 2.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.08% 0.86
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

http://www.openwall.com/lists/oss-security/2015/04/14/4
Mailing List
http://packetstormsecurity.com/files/131422/Fedora-abrt-Race-Condition.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/131423/Linux-Apport-Abrt-Local-Root-Exploit.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/131429/Abrt-Apport-Race-Condition-Symlink.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2015/Apr/34
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/74263
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1211223
Third Party Advisory
Issue Tracking
https://github.com/abrt/abrt/pull/810
Patch
Third Party Advisory
Issue Tracking
https://www.exploit-db.com/exploits/36746/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/36747/
Third Party Advisory
Exploit
VDB Entry